7. Services to configure
What it is
Besides AWS and GitHub, every project uses a handful of outside services: error tracking, email, push notifications, crash reporting, analytics, monitoring, and often an AI provider. This section has one setup page for each, in the same step-by-step format.
Why we do it
Each of these is quick to set up badly and slow to fix later: errors that cannot be traced to a build, emails that land in spam, push notifications that work only in dev, a shared key that mixes test and real data. Setting them up properly in week one costs a day.
Which services, and when
| Service | Needed for | Required? | Set up in | Page |
|---|---|---|---|---|
| Sentry | Errors from API, web and mobile | Every project | Day 5 | Sentry |
| Amazon SES | Sign-in codes, receipts, notices by email | Any project that sends email | Day 5 | Email with SES |
| Monitoring and alerts | Knowing prod is down before users tell you | Every project | Day 5 | Monitoring and alerts |
| Firebase Cloud Messaging + APNs | Push notifications | Projects with a mobile app | Week 2 | Push notifications |
| Firebase Crashlytics | Mobile crash reports | Projects with a mobile app | Week 2 | Crashlytics |
| Analytics | Product usage, funnels | When the client asks for it | Week 2 | Analytics |
| AI providers | Chat, summaries, voice | When the product uses AI | Week 2 | AI providers |
| Payments | Taking money | When the product sells | When accounts arrive | Payments |
| Bot protection (Turnstile) | Public sign-up and forms | Public web forms | With the form | Web security |
The rules for every service
Separate projects or keys per environment. A dev key in prod mixes test data into real data; a prod key in dev spends real money and can message real users.
Keys live in SSM, never in the repo, never in a front-end bundle. Mobile apps get only public identifiers (a Sentry DSN, Firebase config files), never server keys.
Every service that collects personal data is in the privacy policy, the store privacy labels and the data map before it ships. See Data privacy.
Done when
- Every required service is set up and tested on dev.
- Each has a row in
OWNERSHIP.md. - Each has a spend limit or usage alert.